Don't pass semi-detached renderers to the flow thread (or anyone else).

Source/core/rendering/RenderBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 1007 matching lines @@
         ASSERT(!c->isInline());
 #endif
 
     setShouldDoFullPaintInvalidation();
 }
 
 void RenderBlock::removeLeftoverAnonymousBlock(RenderBlock* child)
 {
     ASSERT(child->isAnonymousBlock());
     ASSERT(!child->childrenInline());
+    ASSERT(child->parent() == this);
 
     if (child->continuation() || (child->firstChild() && (child->isAnonymousColumnSpanBlock() || child->isAnonymousColumnsBlock())))
         return;
 
-    LayoutObject* firstAnChild = child->m_children.firstChild();
-    LayoutObject* lastAnChild = child->m_children.lastChild();
-    if (firstAnChild) {
-        LayoutObject* o = firstAnChild;
-        while (o) {
+    // Promote all the leftover anonymous block's children (to become children of this block
+    // instead). Put them right after the leftover block. We still want to keep the leftover block
+    // in the tree for a moment, for notification purposes done further below (flow threads and
+    // grids).
+    if (LayoutObject* firstPromotee = child->firstChild()) {
+        LayoutObject* lastPromotee = child->lastChild();
+        LayoutObject* nextSiblingOfPromotees = child->nextSibling();
+        for (LayoutObject* o = firstPromotee; o; o = o->nextSibling())
             o->setParent(this);
-            o = o->nextSibling();
-        }
-        firstAnChild->setPreviousSibling(child->previousSibling());
-        lastAnChild->setNextSibling(child->nextSibling());
-        if (child->previousSibling())
-            child->previousSibling()->setNextSibling(firstAnChild);
-        if (child->nextSibling())
-            child->nextSibling()->setPreviousSibling(lastAnChild);
-
-        if (child == m_children.firstChild())
-            m_children.setFirstChild(firstAnChild);
-        if (child == m_children.lastChild())
-            m_children.setLastChild(lastAnChild);
-    } else {
-        if (child == m_children.firstChild())
-            m_children.setFirstChild(child->nextSibling());
-        if (child == m_children.lastChild())
-            m_children.setLastChild(child->previousSibling());
-
-        if (child->previousSibling())
-            child->previousSibling()->setNextSibling(child->nextSibling());
-        if (child->nextSibling())
-            child->nextSibling()->setPreviousSibling(child->previousSibling());
+        child->children()->setFirstChild(0);
+        child->children()->setLastChild(0);

[dsinclair, 2015/02/17 18:25:01]

nit: change the 0's to nullptrs

[mstensho (USE GERRIT), 2015/02/18 20:02:25]

Done.

+        firstPromotee->setPreviousSibling(child);
+        child->setNextSibling(firstPromotee);
+        lastPromotee->setNextSibling(nextSiblingOfPromotees);
+        if (nextSiblingOfPromotees)
+            nextSiblingOfPromotees->setPreviousSibling(lastPromotee);
+        if (children()->lastChild() == child)
+            children()->setLastChild(lastPromotee);
     }
 
-    child->children()->setFirstChild(0);
-    child->m_next = nullptr;
-
     // Remove all the information in the flow thread associated with the leftover anonymous block.
     child->removeFromLayoutFlowThread();
 
     // RenderGrid keeps track of its children, we must notify it about changes in the tree.
     if (child->parent()->isRenderGrid())
         toRenderGrid(child->parent())->dirtyGrid();
 
-    child->setParent(0);
-    child->setPreviousSibling(0);
-    child->setNextSibling(0);
-
+    // Now remove the leftover anonymous block from the tree, and destroy it. We'll rip it out
+    // manually from the tree before destroying it, because we don't want to trigger any tree
+    // adjustments with regards to anonymous blocks (or any other kind of undesired chain-reaction).
+    children()->removeChildNode(this, child, false);
     child->destroy();
 }
 
 static bool canMergeContiguousAnonymousBlocks(LayoutObject* oldChild, LayoutObject* prev, LayoutObject* next)
 {
     if (oldChild->documentBeingDestroyed() || oldChild->isInline() || oldChild->virtualContinuation())
         return false;
 
     if ((prev && (!prev->isAnonymousBlock() || toRenderBlock(prev)->continuation() || toRenderBlock(prev)->beingDestroyed()))
         || (next && (!next->isAnonymousBlock() || toRenderBlock(next)->continuation() || toRenderBlock(next)->beingDestroyed())))
@@ skipping 2858 matching lines @@
 void RenderBlock::showLineTreeAndMark(const InlineBox* markedBox1, const char* markedLabel1, const InlineBox* markedBox2, const char* markedLabel2, const LayoutObject* obj) const
 {
     showLayoutObject();
     for (const RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox())
         root->showLineTreeAndMark(markedBox1, markedLabel1, markedBox2, markedLabel2, obj, 1);
 }
 
 #endif
 
 } // namespace blink